Privacy Policy

Account data: When you register, we collect your email address and a hashed password. If you register via a third-party provider, we receive basic profile information from that provider.

Learning data: We store the words you add, your review history, flashcard scores, and other in-app activity needed to operate the spaced-repetition system.

Payment data: Payments are processed by Stripe. We do not store your card details. We receive a record of your subscription status and transaction history from Stripe.

Usage and analytics data: We use PostHog (hosted on the EU cloud) to collect anonymised usage data — pages visited, features used, session duration, device type, and browser. PostHog sets cookies for this purpose (see Section 6).

Technical data: Standard server logs may capture your IP address, browser type, and request timestamps for security and debugging purposes.

Performance of a contract (Art. 6(1)(b)): Processing your account and learning data is necessary to provide the Service you signed up for.

Legitimate interests (Art. 6(1)(f)): We process analytics and technical log data to improve the Service, prevent abuse, and maintain security.

Consent (Art. 6(1)(a)): Where we rely on consent (e.g. non-essential analytics cookies), you may withdraw it at any time without affecting the lawfulness of prior processing.

Legal obligation (Art. 6(1)(c)): We may process data where required by applicable law or regulation.

To provide and operate the Service: Managing your account, delivering personalised vocabulary review, and enabling all features.

To process payments: Verifying subscription status and managing billing via Stripe.

To improve the Service: Analysing aggregated usage patterns via PostHog to understand how features are used and where improvements are needed.

To communicate with you: Sending transactional emails (e.g. password reset, billing receipts). We will not send marketing emails without your explicit consent.

To ensure security: Detecting and preventing fraud, abuse, and unauthorised access.

PostHog (EU Cloud): Analytics. Data is processed within the EU. PostHog's privacy policy is available at posthog.com/privacy.

Stripe: Payment processing. Stripe may process data outside the EU under Standard Contractual Clauses. Stripe's privacy policy is available at stripe.com/privacy.

Hosting infrastructure: Our servers may be provided by a cloud infrastructure provider. Where data is processed outside the EEA, we ensure appropriate safeguards are in place.

Essential cookies: Required for the Service to function (e.g. authentication session tokens, colour scheme preference). These cannot be disabled.

Analytics cookies (PostHog): PostHog sets cookies to track sessions and user behaviour across visits. These help us understand how the Service is used. You may opt out by adjusting your browser settings or contacting us — note that this may affect some functionality.

Access: Request a copy of the personal data we hold about you.

Rectification: Ask us to correct inaccurate or incomplete data.

Erasure ("right to be forgotten"): Request deletion of your personal data, subject to legal retention obligations.

Restriction: Ask us to restrict processing in certain circumstances.

Portability: Receive your data in a structured, machine-readable format.

Objection: Object to processing based on legitimate interests.

Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawfulness.